PT-2024-24935 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: The Logo Slider WordPress plugin versions prior to 4.0.0 Description: The issue concerns the lack of validation and escaping of certain Slider Settings in the plugin, which could allow users with the contributor role and above to perform Stor...

UBUNTU-CVE-2024-5480

A vulnerability in the PyTorch's torch.distributed.rpc framework, specifically in versions prior to 2.2.2, allows for remote code execution RCE. The framework, which is used in distributed training scenarios, does not properly verify the functions being called during RPC Remote Procedure Call...

CVE-2024-5225 SQL Injection in berriai/litellm

An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...

Lunary 代码问题漏洞

lunary is a production toolkit for LLM. A cross-site request forgery vulnerability exists in lunary, which stems from a failure to validate a user-supplied URL, and can be exploited by an attacker to disclose sensitive information...

LiteLLM Code Injection Vulnerability

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. LiteLLM suffers from a code injection vulnerability that stems from insufficient cleaning and validation of model output data, leading to a stored cross-site scripting vulnerability...

PT-2024-33256 · Google · Google Kms

Name of the Vulnerable Software and Affected Versions: berriai/litellm version 1.34.6 Description: A code injection issue exists due to the use of unvalidated input in the eval function within the secret management system. This issue requires a valid Google KMS configuration file to be exploitabl...

AnythingLLM Input Validation Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. An input validation error vulnerability exists in AnythingLLM that stems from the application failing to properly validate user input before passing it to prisma functions and other critical operations...

Online Fire Reporting System ofrs/admin/index.php File SQL Injection Vulnerability

Online Fire Reporting System is an online fire reporting system. The Online Fire Reporting System suffers from a SQL injection vulnerability that originates from a lack of validation of external input SQL statements in ofrs/admin/index.php. The vulnerability can be exploited by an attacker to...

RHEL 6 : xorg-x11-server (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - xorg-x11-server: unvalidated lengths in RENDER extension CVE-2017-12187 - In the X.Org X server before...

RHEL 7 : xorg-x11-server (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - xorg-x11-server: unvalidated lengths in RENDER extension CVE-2017-12187 - The ProcPutImage function in...

RHEL 6 : openstack-swift-plugin-swift3 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - openstack-swift-plugin3: replay attack - date/date header unvalidated CVE-2015-8466 Note that Nessus has not tested...

PT-2024-4470 · Windscribe · Windscribe

Name of the Vulnerable Software and Affected Versions: Windscribe affected versions not specified Description: The issue is related to a directory traversal vulnerability in the Windscribe Service, which can be exploited by local attackers to escalate privileges on affected installations of...

Huawei PC Manager 安全漏洞

Huawei PC Manager is a computer management application from Huawei China. A security vulnerability exists in Huawei PC Manager, which arises from a communication buffer size that is not properly validated to be the expected size and may overlap with the starting SMRAM section, which can be...

Oracle Linux 8 : squashfs-tools (ELSA-2024-3139)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3139 advisory. 4.3-21 - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix CVE-2021-40153 squashfs-tools: unvalidated filepaths...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to an unvalidated returnURL parameter in the dev/build endpoint, which can cause users to be redirected to unverified third-party URLs...

Contributed Rack Middleware and Utilities 安全漏洞

Contributed Rack Middleware and Utilities is a collection of various add-ons for Rack, a Ruby web server interface. A security vulnerability exists in Contributed Rack Middleware and Utilities versions prior to 2.5.0, which stems from unrestricted user-controlled data that is susceptible to...

NETGEAR ProSAFE Network Management System File Upload Vulnerability

NETGEAR ProSAFE Network Management System is a network management system from NETGEAR for centralized management, monitoring, and configuration of network devices. A file upload vulnerability exists in the NETGEAR ProSAFE Network Management System, which stems from the application's lack of...

CVE-2024-5227

TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability...

Silverstripe XSS in dev/build returnURL Parameter

A XSS risk exists in the returnURL parameter passed to dev/build. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site. This issue is resolved in framework 3.1.14 stable release...

GHSA-HQ4P-5MPR-JJ9M Silverstripe XSS in dev/build returnURL Parameter

A XSS risk exists in the returnURL parameter passed to dev/build. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site. This issue is resolved in framework 3.1.14 stable release...